A ransomware attack that encrypts your online backups is not a hypothetical. A cloud provider that deletes your account for a false flag is not a hypothetical. The one backup that survives both is the one that lives on a drive you actually unplug — cold storage, the boring answer that keeps working. Seven Windows, macOS, and Linux apps that do this properly: scheduled snapshots, encryption before the drive spins up, verification you can run yourself, and a restore that doesn’t require a working internet connection.
What to look for in a cold storage backup app
- Client-side encryption before anything hits the target drive
- Incremental snapshots that don’t re-copy everything each time
- Verifiable integrity so a bit-flip on the shelf is caught, not silently kept
- Restore without the original app — a plain file format matters
- Scheduling that reminds you to plug the drive back in, not a timer that runs silently while the disk is missing
- Cross-platform restore for when the machine dies and you’re recovering on a different OS
Quick comparison
| App | Best for | Platforms | Free plan | Starting price |
|---|---|---|---|---|
| Duplicati | Encrypted incremental snapshots to any target | Windows, macOS, Linux | Free, open source | Free |
| Kopia | Deduplicated snapshots with a modern UI | Windows, macOS, Linux | Free, open source | Free |
| restic | Command-line snapshots for scripting | Windows, macOS, Linux | Free, open source | Free |
| Syncthing | Continuous sync to an external drive | Windows, macOS, Linux, Android | Free, open source | Free |
| Veeam Agent Free | Bare-metal image backup | Windows | Free | Free |
| Macrium Reflect X | Recovery-focused disk imaging | Windows | 30-day trial | $79.99 one-time |
| SyncBackFree | File-copy backup with schedules | Windows | Free | Free |
The apps
1. Duplicati — Best overall
Duplicati is the closest thing to a “one-app default” for cold storage. It encrypts everything client-side before touching the drive, deduplicates blocks so a nightly snapshot is small, and stores the archive as portable .dblock files you can restore on any OS with the app installed. The GUI walks you through a first backup in about three minutes.
Where it falls short: The 2.x builds have been in “beta” for years while the daily builds are stable enough for most users. Restore-verification is slower than restic on large repositories. Windows Service mode requires a small config file if you want backups to run without a logged-in user.
Pricing:
- Free: full app, open source
- Paid: none
Platforms: Windows 10+, macOS 12+, Linux (deb, rpm, AppImage) Download: duplicati.com Bottom line: The pick if you want one app that covers the whole flow — encrypt, snapshot, verify, restore — without paying anyone.
2. Kopia — Best modern UI
Kopia takes Duplicati’s ideas and rebuilds the UI. It shows what changed since the last snapshot, previews restore contents, and manages retention rules in plain settings tabs. The block-based deduplication compresses well; a 1TB documents folder often snapshots to 300GB.
Where it falls short: Documentation is thinner than Duplicati’s. Some restore workflows still push you to the CLI. Repository format has changed twice in three years — new backups fine, old backups need a migration.
Pricing: Free, open source.
Platforms: Windows 10+, macOS 12+, Linux Download: kopia.io Bottom line: The pick if the UI is what stops you from actually running backups.
3. restic — Best for scripters
restic is a single Go binary that encrypts snapshots, deduplicates by content-defined chunks, and never trusts the target drive. Automate it with cron on Linux or Task Scheduler on Windows. The community forge tools (autorestic, resticprofile) add a friendly config layer on top.
Where it falls short: No GUI in the core project. Documentation assumes command-line comfort. First snapshot on a big folder can peg a laptop for hours.
Pricing: Free, open source.
Platforms: Windows 10+, macOS 12+, Linux, BSD Download: restic.net Bottom line: The pick if you already write shell scripts and want the smallest backup tool that does the whole job.
4. Syncthing — Best for continuous sync to an external drive
Syncthing isn’t a snapshot tool; it’s a live folder-mirror that runs peer-to-peer. Plug in the external drive, and Syncthing catches it up with your working folders. Pair it with the drive’s own hardware snapshots (btrfs, ZFS, VSS) and you have both live and point-in-time coverage.
Where it falls short: Not versioned by default — turn on “staggered” or “trash-can” versioning explicitly. Sync speed depends on the number of files, not their total size, so a folder with 200,000 small files takes a while.
Pricing: Free, open source.
Platforms: Windows 10+, macOS 12+, Linux, BSD, Android, iOS Download: syncthing.net Bottom line: The pick if you want the external drive to be a live mirror, not just a nightly snapshot target.
5. Veeam Agent Free — Best for full-disk images on Windows
Veeam Agent for Windows (free tier) takes bare-metal images that restore the whole OS to a new drive if the primary fails. It’s what recovery-day plans are built on. Schedule it to an external drive, and you have a complete disaster-recovery image alongside your file-level backups.
Where it falls short: Windows only. The free tier locks out cluster and BitLocker-encrypted-volume scenarios. Enterprise pricing on the upsell is aggressive.
Pricing:
- Free: single-machine image backups
- Paid: Veeam Data Cloud starts at $180/user/year for full features
Platforms: Windows 10+, Windows Server 2019+ Download: veeam.com/products/free/agent-windows.html Bottom line: The pick for Windows users who want a bare-metal recovery image, not just files.
6. Macrium Reflect X — Best for recovery discipline
Macrium Reflect X is a paid disk-imaging tool with the most reliable rescue media in the space. Boot from a USB stick, restore to a different-brand drive, and the app works. Incremental images are quick and the “Rapid Delta Restore” pulls only changed sectors when recovering.
Where it falls short: Free tier was retired in 2024. Windows only. Verbose UI for anyone who just wants a nightly image.
Pricing:
- Free: 30-day trial
- Paid: $79.99 one-time (Home license, up to 4 PCs)
Platforms: Windows 10+, Windows Server 2019+ Download: macrium.com Bottom line: The pick if you want a Windows recovery tool that has done this since 2006 and still updates yearly.
7. SyncBackFree — Best for simple file copies
SyncBackFree copies files to an external drive on a schedule, no encryption, no dedup, no snapshots — just files. Pair it with drive-level BitLocker or LUKS and you get the useful bits without an app-level format lock-in.
Where it falls short: Windows only. No encryption inside the app. Restoring means copying files back manually.
Pricing:
- Free: full app
- Paid: SyncBackPro at $59.95 adds versioning and script hooks
Platforms: Windows 10+ Download: 2brightsparks.com/freeware/freeware-hub.html Bottom line: The pick when you want the backup drive to hold plain files, not an archive that needs an app to open.
How to pick the right one
If you want one app that does encrypted incremental snapshots and a restore that works cross-platform, pick Duplicati. If the UI is what stops you from setting up backups, pick Kopia. If you script your own tooling, pick restic. If you want your external drive to be a live mirror, pick Syncthing. If you’re on Windows and want a bare-metal recovery image, pick Veeam Agent Free and pair it with one of the file-level tools above. If recovery discipline matters more than price, pick Macrium Reflect X. If you want your backups to be plain files, pick SyncBackFree with BitLocker on the drive.
A resilient setup is not one app — it’s two. Most operators pair a snapshot tool (Duplicati, Kopia, restic) with a live mirror (Syncthing) or an image tool (Veeam, Macrium). Two different formats, two different failure modes, one drive that spends most of its time in a drawer.
FAQ
Why is unplugging the drive the whole point? A backup that’s always connected can be encrypted by ransomware in the same run that hit your working files. A drive that spends 23 hours a day disconnected is out of reach for that scenario.
How often should I plug the drive back in? Weekly for most home setups; nightly if you handle work you can’t rebuild. Set a phone reminder — no software can plug a drive in for you.
Does encryption slow things down? On modern CPUs, AES-256 in Duplicati or restic runs at roughly 1-2 GB/s per core. The bottleneck is usually the USB port or the disk itself, not the encryption.
What if the backup drive fails? That’s why the 3-2-1 rule exists: 3 copies, 2 media, 1 off-site. Add a second external drive that lives at a family member’s house, and rotate.
Can I use these to back up to Google Drive or S3? Duplicati, Kopia, and restic all support cloud targets natively. For a true cold backup, target the local drive and let the cloud copy be an extra layer.
